The web console and JavaScript debugger do not sanitize all output that can be hyperlinked.

Published 8 y ago 2018-06-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.3

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.4%

percentile 73%

Public exploits

none known

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60.

Exploit prediction (EPSS)

1.41% probability of exploitation in the next 30 days, higher than 73% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	4.3	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Affected products

Mozilla Firefox

Classification

Weakness

CWE-20 Improper Input Validation

References

mozilla.org /security/advisories/mfsa2018-11/ · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1040896 · vdb-entry, x_refsource_SECTRACK, x_transferred
usn.ubuntu.com /3645-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
securityfocus.com /bid/104139 · vdb-entry, x_refsource_BID, x_transferred
bugzilla.mozilla.org /show_bug.cgi?id=1447969 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-5167
NVD: CVE-2018-5167

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.